Android malware was discovered in June 2026 that installs on Android‑based automotive head unit firmware through the legitimate update application TWCore. The malware does not display a user interface and is delivered as a system app with the package name com.tw.core. It is a multi‑stage downloader that ultimately enables ad fraud and builds a proxy botnet. The infection chain begins when TWCore receives an MQTT message containing an APK download link and an installNotExists flag; if the flag is true, the app installs the malware. The APK is saved to /push/apk/ and installed. The first stage, JarService, is a dropper with no UI that decrypts XOR‑encrypted blocks to obtain information about the next payload and the entry point for a second‑stage loader. The loader decrypts strings, sends device information to a command‑and‑control server via POST, and receives a link to download a third‑stage payload. That payload is executed by the init method of the com.ast.sdk.BillingMain class. The third stage includes a clicker/reverse proxy module called zhima, which contacts C2 servers every 90 minutes and receives updated configuration and command identifiers. The C2 server returns configuration version 3.82 and lists hosts such as hxxp://t2.kshahnd[sbs] and hxxp://t2.mdsjhd[sbs]. The malware uses a small subset of nine possible commands, primarily loadlib2 and http, to download and execute additional code. Researchers attribute the activity to the MoYu Group, which is linked to the BADBOX botnet, based on naming patterns, shared infrastructure, and overlap with other reports. Kaspersky detection names include HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, and others. The vendor DoFun reported fixing the security issue after being notified. Indicators of compromise include file hashes for each stage, domain and IP addresses used for C2 communication, and URLs for APK downloads. The case demonstrates that automotive infotainment systems are now viable targets for sophisticated malware and highlights the need for stronger security controls in head unit firmware.